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ENCRYPTION IN A SECURE 



COMPUTERIZED GAMING SYSTEM 




5 Tltc invention iilalis guiually to computerized w n goring game cyatcma, and 

/ more specificallv/to use of encryption and hash functions to ensure security in a 
o ompu l ctiifxaVwdgeiiiig game sys t em * 

Notice of Co-pending Applications 
This application is related to co-pending application 09/405,921 and to co- 



10 pending application attorney docket 307.029US 1 , filed on the same date as the present 
application, entitled Computerized Gaming System, Method and Apparatus, which are 
hereby incorporated by reference. 



1 5 enjoyed increased and widespread popularity in recent times. As with most forms of 
entertainment, players enjoy playing a wide variety of games and new games. Playing 
new games adds to the excitement of "gaming." As is well known in the art and as used 
herein, the term "gaming" and "gaming devices" are used to indicate that some form of 
wagering is involved, and that players must make wagers of value, whether actual 

20 currency or some equivalent of value, e.g., token or credit. 

One popular game of chance is the slot machine. Conventionally, a slot machine 
is configured for a player to wager something of value, e.g., currency, house token, 
established credit or other representation of currency or credit. After the wager has been 
made, the player activates the slot machine to cause a random event to occur. The player 

25 wagers that particular random events will occur that will return value to the player. A 
standard device causes a plurality of reels to spin and ultimately stop, displaying a 
random combination of some form of indicia, for example, numbers or symbols. If this 
display contains one of a preselected plurality of winning combinations, the machine 
releases money into a payout chute or increments a credit meter by the amount won by 
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Games of chance have been enjoyed by people for thousands of years and have 
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the player. For example, if a player initially wagered two coins of a specific 
denomination and that player achieved a payout, that player may receive the same 
number or multiples of the wager amount in coins of the same denomination as wagered. 
There are many different formats for generating the random display of events that 
5 can occur to determine payouts in wagering devices. The standard or original format was 
the use of three reels with symbols distributed over the face of the wheel. When the three 
reels were spun, they would eventually each stop in turn, displaying a combination of 
three symbols (e.g., with three wheels and the use of a single payout line as a row in the 
middle of the area where the symbols are displayed.) By appropriately distributing and 
1 0 varying the symbols on each of the reels, the random occurrence of predetermined 

winning combinations can be provided in mathematically predetermined probabilities. 
By clearly providing for specific probabilities for each of the preselected winning 
outcomes, precise odds that would control the amount of the payout for any particular 
combination and the percentage return on wagers for the house could be readily 
1 5 controlled. 

Other formats of gaming apparatus that have developed in a progression from the 
pure slot machine with three reels have dramatically increased with the development of 
□ video gaming apparatus. Rather than have only mechanical elements such as wheels or 

f | reels that turn and stop to randomly display symbols, video gaming apparatus and the 

£3 20 rapidly increasing sophistication in hardware and software have enabled an explosion of 

new and exciting gaming apparatus. The earlier video apparatus merely imitated or 
simulated the mechanical slot games in the belief that players would want to play only 
the same games. Early video games therefore were simulated slot machines. The use of 
video gaming apparatus to play new games such as draw poker and Keno broke the 
25 ground for the realization that there were many untapped formats for gaming apparatus. 
Now casinos may have hundreds of different types of gaming apparatus with an equal 
number of significant differences in play. The apparatus may vary from traditional three 
reel slot machines with a single payout line, video simulations of three reel video slot 
machines, to five reel, five column simulated slot machines with a choice of twenty or 
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more distinct pay lines, including randomly placed lines, scatter pays, or single image 
payouts. In addition to the variation in formats for the play of games, bonus plays, bonus 
awards, and progressive jackpots have been introduced with great success. The bonuses 
may be associated with the play of games that are quite distinct from the play of the 
5 original game, such as the video display of a horse race with bets on the individual horses 
randomly assigned to players that qualify for a bonus, the spinning of a random wheel 
with fixed amounts of a bonus payout on the wheel (or simulation thereof), or attempting 
to select a random card that is of higher value than a card exposed on behalf of a virtual 
dealer. 

10 Examples of such gaming apparatus with a distinct bonus feature includes U.S. 

Patent Nos. 5,823,874; 5,848,932; 5,836,041; U.K. Patent Nos. 2 201 821 A; 2 202 984 
*D A; and 2 072 395A; and German Patent DE 40 14 477 Al . Each of these patents differ in 

j^j fairly subtle ways as to the manner in which the bonus round is played. British patent 2 

D 201 821 A and DE 37 00 861 Al describe a gaming apparatus in which after a winning 

4= 

□ 1 5 outcome is first achieved in a reel-type gaming segment, a second segment is engaged to 
4= determine the amount of money or extra games awarded. The second segment gaming 

s 

□ play involves a spinning wheel with awards listed thereon (e.g., the number of coins or 
q number of extra plays) and a spinning arrow that will point to segments of the wheel with 

the values of the awards thereon. A player will press a stop button and the arrow will 

□ 20 point to one of the values. The specification indicates both that there is a level of skill 

possibly involved in the stopping of the wheel and the arrow(s), and also that an 
associated computer operates the random selection of the rotatable numbers and 
determines the results in the additional winning game, which indicates some level of 
random selection in the second gaming segment. 
25 U.S. Patents Nos. 5,823,874 and 5,848,932 describe a gaming device comprising: 

a first, standard gaming unit for displaying a randomly selected combination of indicia, 
said displayed indicia selected from the group consisting of reels, indicia of reels, indicia 
of playing cards, and combinations thereof; means for generating at least one signal 
corresponding to at least one select display of indicia by said first, standard gaming unit; 
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means for providing at least one discernible indicia of a mechanical bonus indicator, said 
discernible indicia indicating at least one of a plurality of possible bonuses, wherein said 
providing means is operatively connected to said first, standard gaming unit and becomes 
actuatable in response to said signal. In effect, the second gaming event simulates a 
mechanical bonus indicator such as a roulette wheel or wheel with a pointing element. 

A video terminal is another form of gaming device. Video terminals operate in 
the same manner as conventional slot or video machines except that a redemption ticket 
is issued rather than an immediate payout being dispensed. 

The vast array of electronic video gaming apparatus that is commercially 
available is not standardized within the industry or necessarily even within the 
commercial line of apparatus available from a single manufacturer. One of the reasons for 
this lack of uniformity or standardization is the fact that the operating systems that have 
been used to date in the industry are primitive. As a result, the programmer must often 
create code for each and every function performed by each individual apparatus. To date, 
no manufacturer is known to have been successful in creating a universal operating 
system for converting existing equipment (that includes features such as reusable 
modules of code) at least in part because of the limitations in utility and compatibility of 
the operating systems in use. When new games are created, new hardware and software 
is typically created from the ground up. 

At least one attempt has been made to create a universal gaming engine that 
segregates the code associated with random number generation and algorithms applied to 
the random number string from the balance of the code. Carlson U.S. Patent 5,707,286 
describes such a device. This patentee recognized that modular code would be beneficial, 
but only contemplated making RNJ and transfer algorithms modular. 

The lack of a standard operating system has contributed to maintaining an 
artificially high price for the systems in the market. The use of unique hardware 
interfaces in the various manufactured video gaming systems is a contributing factor. 
The different hardware, the different access codes, the different pin couplings, the 
different harnesses for coupling of pins, the different functions provided from the various 
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pins, and the other various and different configurations within the systems has prevented 
any standard from developing within the technical field. This is advantageous to the 
apparatus manufacturer, because the games for each system are provided exclusively by a 
single manufacturer, and the entire systems can be readily obsoleted, so that the market 
will have to purchase a complete unit rather than merely replacement software. Also, 
competitors cannot easily provide a single game that can be played on different hardware. 
A solution to this problem is presented in our co-pending application for Video Gaming 
Apparatus for Wagering with Universal Computerized Controller and I/O Interface for 
Unique Architecture, assigned serial number 09/405,921, and filed September 24, 1999, 
the disclosure that is incorporated herein by reference. 

The invention of computerized gaming systems that include a common or 
universal video wagering game controller that can be installed in a broad range of video 
gaming apparatus without substantial modification to the game controller has made 
possible the standardization of many components and of corresponding gaming software 
within gaming systems. Such systems desirably will have functions and features that are 
specifically tailored to the unique demands of supporting a variety of games and gaming 
apparatus types, and will do so in a manner that is efficient, secure, and cost-effective. 

In addition to making communication between a universal operating system and 
non-standard machine devices such as coin hoppers, monitors, bill validators and the like 
possible, it would be desirable to provide security features that enable the operating 
system to verify that game code and other data has not changed during operation. 

Alcorn et al U.S. Patent 5,643,086 describes a gaming system that is capable of 
authenticating an application or game program stored on a mass media device such as a 
CD-ROM, RAM, ROM or other device using hashing and encryption techniques. The 
mass storage device may be located in the gaming machine, or may be external to the 
gaming machine. This verification technique therefore will not detect any changes that 
occur in the code that is executing because it tests the code residing in mass storage prior 
to loading into RAM. 
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What is desired is an architecture and method providing a gaming-specific 
platform that features secure storage and verification of game code and other data, 
provides the ability to securely change game code on computerized wagering gaming 
system, and has the ability to verify that the code has not changed during operation of the 
gaming machine. 

It is further desired that the game program code be identifiable as certified or 
approved, such as by the Nevada Gaming Regulations Commission or other regulatory 
agency. 5 Jo 

y/* Summary of the Invention ■ 

The invention p r ovides an ai^hrpQcture and method for a wagering game s p e crfir 
platform that features secure stora^and verification of game code and other data, 
provides the ability to secureh/exchange data with a computerized wagering gaming 
system, and does so in a manner that is straightforward and easy to manage. Some 
embodiments of the invention provide the ability to identify game program code as 
certified or approved, such as by the Nevada Gaming Regulations Commission or other 
regulatory agency. The invention provides these and other functions by use of 
encrypt^fC including digital signatures and hash functions as well as other encryption 
methods. Such functions are advantageously applied to data loaded into RAM and occur 
ile the gaming machine i3 in opcratiom 

Brief Description of the Figures 

■ppiita^U-ypyra^^Prtng g flmfHipp*r*+ii<; gnr.h flg mfiy hf 

s fmU.il . 1 ' MN II iM ^nHirnRntn nf thr prn.Qp.nt i nvrn ti nw 

-Eigw aJ? ghnw^ yfo flrnm nf o ne i twnrk ft H mmpntnr connected tn QGrtn i n 
components comppslng a portion of a computerized wagering game apparatus, consistent 
^vrtfr s o m o c^ripodimcntc of the present inven t ion. 

Figure 3 is a diagram of a process of creating a signature for a loadable data set, 
utilizing a public/private key algorithm. 

Figure 4 is a diagram of a process for verifying a loadable data set has not 
changed during operation of the gaming device. 
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made to the accompanying drawing^which form a part hereof, and in which is shown by 
way of illustration specific sarojtfe embodiments in which the invention may be practiced. 
These embodiments are described in sufficient detail to enable those skilled in the art to 
practice the inventio*Cand it is to be understood that other embodiments may be utilized 
and that logicj^mechanical, electrical, and other changes may be made without 
departing^rom the spirit or scope of the present invention. The following detailed 
description is, therefore, not to be taken in a limiting sense, and the scope of the invention 
jf N^flnf d "nly by tV> ^ a pp^ nHnrl ^ inimr, 

-^fhc pi'esent invention i r bVaiious embodim e nts provides an a r chitecture an d 
method for a universal operating system that features secure storage and verification of 
game code and other data/ provides the ability to securely exchange data with a 
computerized wagering gaming system, and does so in a manner that is straightforward 
and easy to managed Some embodiments of the invention provide the ability to identify 
game prograrn^code as certified or approved, such as by the Nevada Gaming Commission 
or other regulatory agency. The invention provides these and other functions by use of 
encryption, including digital signatures and hash functions as well as other encryption 
methoas to data being executed. Because hash functions and other encryption methods 
■e mpluycd widely in the picsuU iuv entioftr*hey~are intr oduced an d- discus s ed hem. 
"Hash functions" for purposes of this disclosure are a type of function that 
generates a unique data string, typically of fixed length from variable strings of characters 
or text. The data string generated is typically substantially smaller than the text string 
itself, but is long enough that it is unlikely that the same number will be produced by the 
hash function from different strings of text. The formula employed in the hash function 
must also be chosen such that it is unlikely that different text strings will produce the 
same hash value. An example of a suitable hash function is a 160 bit SHA hash. 
Regardless of file size, the hash value will be 160 bits in length. 
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The hashed data string is commonly referred to as a "message digest." A message 
digest can be stored for future use, or encrypted and then stored in non-volatile memory, 
for example. 

Hash functions are often used to hash data records to produce unique numeric 
values corresponding to each data record in a database, which can then be applied to a 
search string to reproduce the hash value. The hash value can then be used as an index 
key, eliminating the need to search an entire database for the requested data. Some hash 
functions are known as one-way hash functions, meaning that with such a function it is 
extremely difficult to derive a text string that will produce a given hash value, but 
relatively easy to produce a hash value from a text string. This ensures that it is not 
feasible to modify the content of the text string and produce the same hash value. 

Such a function can be used to hash a given character string and produce a first 
hash value that can later be compared to a second hash value derived from the same 
character string, to ensure the character string has not changed. If the character string has 
been altered, the hash values produced by the same hash function will be different. The 
integrity of the first hash value can be protected against alteration by use of other 
encryption methods such as the use of a digital signature. 

Digital signatures are employed to sign electronic documents or character strings, 
and ensure that the character string has not been altered since signing. Digital signatures 
typically are employed to indicate that a character string was intentionally signed with an 
unforgeable signature that is not reusable with another document, and that the signed 
document is unalterable. The digital signing mechanism or method is designed to meet 
these criteria, typically by using complex mathematical encryption techniques. 

One example is use of a public key/private key encryption system to sign a 
document. In a public key/private key system a user has a pair of keys, either of which 
may be used to encrypt or decrypt a document. The public key is published or distributed 
in a manner that reasonably ensures that the key in face belongs to the key owner, and the 
private key is kept strictly secret. If someone wishes to send a character string that only a 
certain person may read, the character string is encrypted before sending using the 
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intended reader's public key. The character string is then visible only by using the 
intended reader's private key to decrypt the character string. 

However, if a user wishes to send a character string in such a manner that the 
document is virtually guaranteed to be the authentic document created by the sender but 
5 essentially anyone can read it, the user can sign the document by encrypting it with his 
private key before sending. Anyone can then decrypt the document with the signer's 
public key which is typically widely distributed, and can thereby verify that the character 
string was signed by the key pair owner. This example embodiment meets the 
requirements of a digital signature, ensuring that a character string was intentionally 
10 signed with an unforgeable signature that is not reusable with another document, and that 

- a the signed document is unalterable. 

□ 

42 Because encryption of large character strings such as large computer programs or 

j^j long text documents can require a substantial amount of time to encrypt and decrypt, 

B some embodiments of digital signatures implement one-way hash functions. In one such 

□ 1 5 embodiment, the signer uses a known one-way hash algorithm to create a hash value for 

^ the character string, and encrypts the hash value with his private key. The document and 

Cl signed hash value are then sent to the recipient, who runs the same hash function on the 

p* character string and compares the resulting hash value with the hash value produced by 

^ decrypting the signed hash value with the signer's public key. Such a method provides 

Q 20 very good security, as long as the hash function and encryption algorithm employed are 

suitably strong. 

Encryption of data via a public key/private key system is useful not only for 
producing digital signatures, but also for encryption of data before sending or storing the 
data or to keep data secure or secret in other applications. Similarly, symmetric 
25 encryption techniques which rely on encryption and decryption of the same single secret 
key may be applied to such applications. For example, transmission of program data 
between a network server and a computerized wagering game apparatus may be secured 
via a symmetric encryption technique, and the program data received in the game 
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apparatus may be verified as approved by a regulatory agency via a digital signature 
employing hash functions and public key cryptography before execution. 
jJ^ x \ Other onoiy pt i u n mulliud^ and formulae exist , a n d are alao usable oonoiotcnt wi t h" 

^^he present invention. Some symmetric encryption methods, such as DES (Data 
5 Encryption Standard) and its variants rely s>n the secrecy of a single key, and so may not 
be adaptable to methods described herein that require a key pair with a public key. A 
variety of other encryption methodsysuch as RSA and Diffie-Hellman are consistent with 
public/private key methods, and are usable in these methods. Various hash functions 
may also be employed, such a/MDS or SHA, and will be useful in many aspects 
10 consistent with the present/invention so long as they are sufficiently nonreversible to be 
considered one-way hash functions. Various encryption methods will also provide 
varying degrees of security, from those that are relatively easy to defeat to those that are 
extremely difficult to defeat. These various degrees of security are to be considered 
within the scope of encryption methods consistent with this application, including various 
1 5 degrees of'security that may to varying degrees of probability make encrypted data 
unforgeable, unreadable, or the like. A variety of encryption methods exist and are 
expected to be developed in the future, all of which are likely to be employable in some 
ifirrt rnm i ntffnt with tilt; r r irSH iil iny^ntirm, nnrl nre within ttv* rTfp n nf t hf ? in ^ ntinn 
Figure 1 shows an exemplary gaming system 100, illustrating a variety of 
20 components typically found in gaming systems and how they may be used in accordance 
with the present invention. User interface devices in this gaming system include push 
buttons 101, joystick 102, and pull arm 103. Credit for wagering may be established via 
coin or token slot 104, a device 105 such as a bill receiver or card reader, or any other 
credit input device. A card reader 105 may also provide the ability to record credit 
25 information on a user's card when the user has completed gaming, or credit may be 

returned via a coin tray 106 or other credit return device. Information is provided to the 
user by devices such as video screen 107, which may be a cathode ray tube (CRT), liquid 
crystal display (LCD) panel, plasma display, light-emitting diode (LED) display, or other 
display device that produces a visual image under control of the computerized game 
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controller. Also, buttons 101 may be illuminated to indicate what buttons may be used to 
provide valid input to the game system at any point in the game. Still other lights or 
other visual indicators may be provided to indicate game information or for other 
purposes such as to attract the attention of prospective game users. Sound is provided via 
speakers 108, and also may be used to indicate game status, to attract prospective game 
users, or for other purposes, under the control of the computerized game controller. 

The gaming system 100 further comprises a computerized game controller 1 1 1 
and I/O interface 1 12, connected via a wiring harness 113. The universal game controller 
1 1 1 need not have its software or hardware designed to conform to the interface 
requirements of various gaming system user interface assemblies, but can be designed 
once and can control various gaming systems via I/O interfaces 1 12 designed to properly 
interface an input and/or output of the universal computerized game controller to the 
interface assemblies found within the various gaming systems. 

In some embodiments, the universal game controller 111 is a standard IBM 
Personal Computer-compatible (PC compatible) computer. Still other embodiments of a 
universal game controller comprise general purpose computer systems such as embedded 
controller boards or modular computer systems. Examples of such embodiments include 
a PC compatible computer with a PC/104 bus, which is an example of a modular 
computer system that features a compact size and low power consumption while retaining 
PC software and hardware compatibility. The universal game controller provides all 
functions necessary to implement a wide variety of games by loading various program 
code on the universal controller, thereby providing a common platform for game 
development and delivery to customers for use in a variety of gaming systems. Other 
universal computerized game controllers consistent with the present invention may 
include any general-purpose computers that are capable of supporting a variety of gaming 
system software, such as universal controllers optimized for cost effectiveness in gaming 
applications or that contain other special-purpose elements yet retain the ability to load 
and execute a variety of gaming software. 
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In yet other embodiments, the universal controller with security features can be 
used for other applications, including controlling networked in-line systems such as 
progressive controllers and player tracking systems. The invention can also be used for 
kiosk displays and creating picture in picture features on a video display. 

The universal computerized game controller of some embodiments is a computer 
running an operating system with a gaming application-specific kernel such as a 
customized Linux kernel. In further embodiments, a system handler application layer of 
code executes within the kernel, further providing common game functionality to the 
programmer. The game program in such embodiments is therefore only a fraction of the 
total code, and relies on the system handler application layer and kernel to provide 
commonly used gaming functions. Still other embodiments will have various levels of 
application code, ranging from embodiments containing several layers of game-specific 
code to a single-layer of game software running without an operating system or kernel 
but providing its own computer system management capability. 

Tigmc 2 illus trate s - a networked computer connected to selected i t ems that * 
comprise a part of a computerized wagering game apparatus, as are used in various 
embodiments of the present invention. The computerized game controller 201 has a 
processor 202, memory 203, and nonvolatile memory 204. One example of nonvolatile 
memory is a flash disk on-chip (hereinafter "flash disk"). The flash disk is 
advantageously reacVwrite, yet retains information stored on disk upon power down. 
Attached to the computerized game controller of some embodiments is a mass storage 
device 205, ajra a network interface adaptor 206. The network interface adaptor is 
attached tpa. networked computer 207 via network connection 208. The various 
complements of Figure 2 exist within embodiments of the invention, and are illustrated to 
s h<CiA7 th^ manner i n w hi ch tile " various components are as so riatedn, 

The computerized wagering game controller of the invention is operable to 
control a computerized wagering game, and is operable to employ encryption in various 
embodiments to provide data security. The computerized game controller 201 in some 
embodiments is a general-purpose computer, such as an IBM PC-compatible computer. 
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The game controller executes an operating system, such as Linux or Microsoft Windows, 
which in further embodiments is modified to execute within the computerized gaming 
apparatus. The computerized game controller also executes game code, which may be 
loaded into memory 203 from either a mass storage device 205 such as a hard disc drive, 
5 or nonvolatile memory 204 such as flash memory or EPROM memory before execution. 
In some embodiments, the computerized game controller 201 loads encryption functions 
into memory 203, and those functions are subsequently executed to securely load other 
gaming system data from the mass storage device 205. 

In further embodiments, the computerized game controller exchanges data with a 
10 networked computer 207 via a network connection 208 and a network interface adapter 
206. Data exchanged via the network connection is encrypted in some embodiments of 
the invention, to ensure security of the exchanged data. The data to be exchanged in 
various embodiments comprises game program data, computerized gaming apparatus 
report data, data comprising commands to control the operation of the computerized 
15 gaming apparatus, and other computerized gaming apparatus data. Employing encryption 
in exchanging such data provides a degree of security, ensuring that such data is not 
altered or forged. 

' The invention employe oneffotion, including hauh fmictiuni>, ^yium oti i u ■ 
encryption, and public key /private key encryption in various embodiments, which 
provides a degree of conpdence that data utilized by the computerized gaming system 
and protected by encryption in accordance with the invention is not altered or forged. 
The data withirL*ne scope of the invention includes but is not limited to data comprising 
programs sucn as operating system or game program data, computerized gaming machine 
status dam such as credits or other game state data, control instruction data for controlling 
25 the gfperation of the computerized gaming apparatus, and other computerized gaming 
Tmichinc data . 

One embodiment of the invention comprises the use of hash functions to calculate 
a reference hash value for selected data, which can later be compared to a hash value 
calculated from the same data or a copy of the data to ensure the data has not been 
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altered. The hash functions employed will desirably be one-way hash functions, to 
provide a greater degree of certainty that the reference hash value cannot be used in 
reverse to produce corresponding altered data. In a further embodiment, the data is 
hashed repeatedly by a continuously executing program thread that ensures that the data 
5 is not altered during the course of operation of the computerized wagering game. The 
data that is continuously hashed is in some embodiments is continuously hashed after 
being loaded into memory 203 for use by the computerized game controller. 

If the reference hash value and the calculated hash value do not match, the 
computerized gaming apparatus will desirably provide some indication of the hash 

10 failure. In one embodiment, the game is brought to a locked or "tilt" state that prevents 
wagering upon a hash check failure. In a further embodiment, notification of the hash 
failure is sent to a networked computer 207 to alert the computer's user of the hash 
failure. In some embodiments, the computerized wagering game apparatus provides 
limited function to check the status of the game, including in further embodiments 

1 5 functions accessible only by operating controls within the computerized wagering game 
apparatus secure housing. 

In one embodiment, the operating system as described in my copending 
application for Computerized Gaming System, Method and Apparatus, filed on the same 
date as this application, cooperates with a library of "shared objects" that are specific to 

20 the game application. For purposes of this disclosure, a "shared object" is defined as 
self-contained, functional units of game code that define a particular feature set or 
sequence of operation for a game. The personality and behavior of a gaming machine of 
the present invention are defined by the particular set of shared objects called and 
executed by the operating system. Within a single game, numerous shared objects may 

25 be dynamically loaded and executed. This definition is in contrast with the conventional 

meaning of a shared object, which typically provides an API to multiple programs. An 

API is an application Programming Interface, and includes a library of functions. 
JO ^ 

^* >■ Jin U ioic d o b j ec t co de, as well a3 other data^Ray be verifie d acc o rd i ng to on 



embodiment of the present invention by first preparing a signature from data, as shown in 
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Figure 3. The signature may be prepare>f>y first hashing 210 the data set 212 to create a 
message digest 214. The message^igest is encrypted via an encryption program that is 
stored on ROM utilizing^private/public key algorithm 218, forming a unique signature 
220. The data and^slgnature are then stored on a mass storage device 222 such as a 
5 aet woik s t ofagc - dcvico, hard drh ^ J^DzKOM, RAM, flash disk ui lh e4&fr, 

In one embodiment, the shared objects for a particular application and their 
corresponding signatures are stored 224 in flash memory. When the shared objects are 
called, it is copied into RAM, where it is hashed 226 on a frequent periodic basis. The 
shared objects may be hashed from flash memory, or loaded into RAM and then hashed 
1 0 from RAM. Utilizing a Linux, Unix or other similar operating system advantageously 
permits the location of data in RAM. Data verification in RAM has the distinct advantage 
that errors will be caught at the time they occur, rather than when the data is loaded or 
reloaded. This could save casinos untold amounts by avoiding the payment of jackpots 
and the like based on machine malfunction. Since hashing is a batch process, the process 
q 1 5 is not continuous. However, when the hashing takes relatively little time, such as 1 0 

^ seconds for example, the process can repeat itself so that the data verification in RAM is 
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The message digest 228 created from hashing the shared object is preferably 
J[ encrypted. A public key 238 is used to decrypt the message digest utilitizing a first 

p 20 decryption program. The signature 240 stored in flash memory is decrypted using a 

second decryption program via a public key 234 and the values are compared 236. 

Although code verification of the gaming program shared objects has been 
described in detail above, code verification utilizing hash functions and signatures can be 
applied to verifying the authenticity of the linux kernel, modular modifications to the 
25 kernel, the operating system, game state data, random number generation data and the 
like. As added security, the present invention contemplates zeroing out all unused RAM 
to verify that no data in the form of code or other data was intentionally or 
unintentionally inserted. 
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In various embodiments, selected data is protected with encryption by signing the 
data with a digital signature that is verified to ensure integrity of the data. In some 
embodiments, the digital signature comprises signing the selected data with a signer's 
private key such that the data can only be decrypted by using the corresponding public 
5 key. Because only the intended signer knows his private key and documents encrypted 
with other private keys cannot be decrypted with the intended signer's public key, 
successful decryption of data with the intended signer's public key provides a degree of 
certainty that the data was signed or encrypted by the intended signer. 

But, because public key/private key encryption algorithms typically take a 
1 0 relatively long time to encrypt large amounts of data, the encryption algorithm is more 
efficiently used in some embodiments to encrypt a unique characteristic of the data such 
^5 as the hash value from a one-way hash function. In such an embodiment, the signer 

=J derives the reference hash value with a one-way hash function for the data to be signed, 

□ and encrypts the resulting hash value with his public key. One-way hash functions 

p 1 5 typically may be applied to data much more quickly than public key/private key 

f B algorithms, and so it is more desirable to process the entire data to be signed with a hash 

E 

r] function than with a public key/private key algorithm. In some embodiments of the 

invention, only the hash value needs to be encrypted with public key/private key 
encryption, greatly reducing the time needed to sign or verify large amounts of data. To 
20 verify the signature, the hash value is decrypted with the intended signer's public key and 
the decrypted reference hash value is compared to a newly-computed hash value of the 
same data. If the reference hash value matches the newly-computed hash value, a degree 
of certainty exists that the signed data has not been altered since it was signed. 

In some embodiments using digital signatures, the digital signature is that of a 
25 regulatory agency or other organization responsible for ensuring the integrity of data in 
computerized wagering game systems. For example, the Nevada Gaming Regulations 
Commission may apply a signature to data used in such gaming systems, ensuring that 
they have approved the signed data. Such an embodiment will be useful to ensure that 
game code executing in these systems has been approved and not altered since approval, 
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and provides security both to the game operator or owner and to the regulatory 
commission. In other embodiments, the digital signature is that of the game code 
manufacturer or designer, and ensures that the game code has not been altered from its 
original state since signing. 

Secure storage of the reference hash values or public keys in the systems 
described above is important, because data can be more easily forged if the reference 
hash values or public keys used to verify the integrity of the data can also be altered. For 
this reason, the reference hash values, public keys, or other encryption key data is stored 
in nonvolatile memory 204. In some embodiments, the nonvolatile memory 204 is a 
flash memory or EPROM that is programmable, but is not readily altered by a user of the 
computerized wagering game apparatus. The nonvolatile memory in such embodiments 
is reprogrammable, but reprogramming requires in various embodiments the use of 
special hardware, execution of restricted functions, or other secure methods. In other 
embodiments, the nonvolatile memory 204 is a programmable memory that is not 
alterable, requiring replacement of the nonvolatile memory each time new encryption key 
data is needed. Such embodiments have the advantage that the nonvolatile memory 204 
must be physically removed and replaced to alter the data, providing a degree of access 
security and allowing visual verification of the identity of the nonvolatile memory and its 
contents. 

In still other embodiments, the encryption key data is stored on the mass storage 
device. Further embodiments include storage of the encryption key data embedded in 
encryption functions, storage in secure areas of a hard disc drive mass storage device, or 
use of other security methods to protect the encryption key data. 

These encryption methods in some embodiments of the invention are also applied 
to computerized gaming system communication over a network. Data communicated 
over a network is in various embodiments of the invention verified by use of a hash 
function, verified by use of public key/private key encryption, verified by use of 
symmetric encryption, or verified by use of digital signatures. Also, a variety of key 
exchange or key negotiation protocols exist which in some embodiments of the invention 
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provide the capability for a networked computerized gaming system to publicly agree 
with another networked computer system on encryption keys that may be subsequently 
used to communicate securely over a network. 

£ ucli network eemmunication methoda aro utilized in the invention to provide for 1 
secure exchange of data between computerized wagering game systems and other 
networked computer systems. For example, control commands that control certain 
aspects of the operation of the computerized wagering games are securely sent over a 
network in some embodiments ofihe invention. Such commands may include increasing 
odds of payout on selected computerized wagering game systems, or changing the game 
program that is executed oj/ selected computerized wagering game systems at selected 
times of the day. The aefrnputerized wagering games in some embodiments securely 
report game data such as bookkeeping data to a networked computer 207 via encryption. 
In still other embodiments of the invention, wagering game program data is securely 
transmitted over the network to the computerized wagering game systems, providing a 
secure wayto provide new wagering games to the systems without physically accessing 
each computerized wagering game system. Various embodiments of the invention 
transmit other computerized wagering game data over a network connection via 
T on, and arc within the Mupc of the invention * 

D cl jum o n u y pt i o n mUliuds typically provide a degmo of accurity tha t-ia. 
dependent on the effort and expense a hacker is willing tp / uivest in defeating the 
encryption, replacement of encryption keys is employed in some embodiments of the 
invention. Digital signatures in some embodiments are valid only for a predetermined 
period of time, and in further embodiments have an associated date of expiry after which 
they may no longer be used. Such method can also be used in various embodiments of 
the invention to license games for use^ror a certain period of time, after which they will 
not be properly verified due to exj^rry of the encryption keys used for data verification. 
Because hash functions typicatfy produce hash values that are dependent entirely on the 
data being hashed, embodiments of the invention which incorporate expiry and 
replacement of referenjafe hash values also require reissuance of modified data to produce 
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a different hash value. For examr^efminor bug fixes, addition of new features, or any 
other small change in me^fcffacomprising a gaming program will be sufficient to produce 
a different reference^ash value upon hashing the edited program data, resulting in an 

updated referent hash va l ue cor res ponding lu lli o updated da t a, 

Q th c i embodiments use a Variety of kcya apfong various compuluizul wagmiug * 
games and game producers, reducing the risk^and therefore the value of successfully 
defeating an encryption key. For example^ a game producer in one embodiment employs 
a different digital signature for eacjmistomer of its computerized wagering games, 
ensuring that defeating the en^ption key on a single game system affects a limited 
number of games. In another embodiment, a regulatory agency may change keys with 
which it signs games^on a periodic basis, so that a successful hack of the keys used to 
sign the data results in potential compromise of only a limited and identifiable number of 
games. ft/will be obvious to one skilled in the art that many variations on key 
replacement and expiry policies exist, all of which are considered within the scope of the 
pr esent inventi o n * 

y^ TYA invention provid e s an architecture and method for a gaming ap ori fir plntf o rnr 
that features secure storage and/verification of game code and other data, provides the 
ability to securely exchan^aata with a computerized wagering gaming system, and does 
so in a manner that is^ti*aightforward and easy to manage. Some embodiments of the 
invention provid^me ability to identify game program code as certified or approved, such 
as by the Neyada Gaming Regulations Commission or other regulatory agency. The 
inventioff^rovides these and other functions by use of encryption, including digital 

s i gnflflirPS and- hf Hl f n n ' , » ; ' "" , » t ' w i '.H i iM i h i h i h r yprinn mrthrt r U 

Although specific embodiments have been illustrated and described herein, it will 
be appreciated by those of ordinary skill in the art that any arrangement which is 
calculated to achieve the same purpose may be substituted for the specific embodiments 
shown. This application is intended to cover any adaptations or variations of the 
invention. It is intended that this invention be limited only by the claims, and the full 
scope of equivalents thereof. 
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